Repository navigation
LDAP federated users are allowed to set local password #34660
Replies: 4 comments 7 replies
|
You can hide the option to change the password in the user profile. |
|
Thanks for your reply. What do you mean by Thanks! |
|
If you do not allow users to set their password in the user profile, go to Authentication > Required Actions in your realm and disable Then, log in with your user account and navigate to the user profile at |
|
Hi @embesozzi, I see, thank you. Wasn't aware of that. Anyway, in my situation, this doesn't help because I have users federated from LDAP that shouldn't change (set) a local password but I also have users that are not federated. And of course, they need to be able to set/reset a password. |
|
As a workaround, I implemented my custom EventListener which simply rolls the password change back if a user has a federation link. Unfortunatly, I'm struggling with providing some feedback to the user in that case. My goal would be to display a message in the Web-UI. But whatever I tried (throw different Exceptions, whatever...) did not come through. Is there any chance to display a message to the user in that case? Here is my provider implementation: import mu.KLogging
import org.keycloak.events.Event
import org.keycloak.events.EventListenerProvider
import org.keycloak.events.EventType
import org.keycloak.events.admin.AdminEvent
import org.keycloak.models.KeycloakSession
import org.keycloak.models.RealmModel
import org.keycloak.models.UserModel
class PasswordChangeEventListenerProvider(private val session: KeycloakSession) : EventListenerProvider {
override fun close() {
}
override fun onEvent(event: Event?) {
when (event?.type) {
EventType.UPDATE_PASSWORD, EventType.RESET_PASSWORD -> handleEvent(event)
else -> return
}
}
override fun onEvent(event: AdminEvent?, includeRepresentation: Boolean) {
}
private fun handleEvent(event: Event) {
val realm: RealmModel = session.realms().getRealm(event.realmId)
val user: UserModel? = session.users().getUserById(realm, event.userId)
user?.let {
if (!it.federationLink.isNullOrBlank()) {
logger.warn { "Realm: ${realm.name}, User: ${it.username} tried to (re)set password but has federation link." }
session.transactionManager.setRollbackOnly()
}
}
}
companion object : KLogging()
} |
|
@ov-developer Did this turn out to be your final working solution? I am working on the exact same thing and I was curious if you had any follow up to this or if maybe you found a way for user feedback. Thanks for your help. My setup is like so in KC 26: My Realm (with organizations enabled) I just want to prevent the federated users from setting up credentials as if they were a local user. And I want the local users to be able to behave normally. |
|
@BrianMaldo, yes, this is my final solution. Instead of using the Keycloak Account Console, my users have a custom UI in place to change their passwords. There, I prevent federated users from changing their passwords in the UI. The EventListener above is "the last resort" in the Backend. |
|
What is the plan for this fix ? Having the same issue where User is created through SSO and linked to Organization, but if he directly access login page then if he tries to use the forgot password , he is able to reset the password and then while logging in next time it is taking to non SSO login process |
|
Also having this issue, had to invent a complex workaround to resolve it for now. The ability to change a credential is determined by the federated identity provider, not the realm, and realms come with explicit support for multiple, differing identity providers. It would seem that configuring the forgot-password function at a realm level is a basic design flaw. I'm also disappointed by the default behavior exhibited in this scenario, Even though keycloak has attempted and failed to update the credential in the remote LDAP database, instead of returning an error message or failing the flow, it creates a locally-cached version of the credential, silently, and only allows the use of that new credential for login. Presumably, LDAP accounts are used in many more places than just keycloak, and this behavior introduced a severe functional discrepancy without informing the user or the keycloak administrator. This has to change. |
|
Hi @pancake-tongs what solution did you use for this. I’m having the same issue. Any help with this is much appreciated. |
We wrote a custom LDAP authentication plugin to handle those cases without displaying the forgot-password link. It's a very poor approach. We're basically adding our own complexity and tech debt to work around a design flaw in keycloak. I wouldn't recommend it, but I have no alternatives to offer. |
Uh oh!
There was an error while loading. Please reload this page.
Hi community,
I have the situation that I have a realm with users federated from an LDAP-Server. The federation-provider is configured with
Edit Mode = UNSYNCEDbecause I need to store some custom attributes for the users.Unfortunately, I found that using the account console, a federated user can set a password locally in Keycloak and use it successfully to login afterwards.
From a security perspective, this sounds strange to me. Is there any option I'm missing, which prevents this? I want all users to authenticate using their LDAP-Password only.
Any help is appreciated. I'm not sure if this is a bug or expected behavior.
Thank you.
All reactions